Deterministic transitions

• Do the same conditions allow for non-deterministic transitions?

• Inconsistencies were found earlier by other methods [Heimdahl and Leveson]

  • Identical conditions allowed transitions from Sensitivity Level 4 to SL 2 or to SL 5

• Our formulae checked for all possible non-determinism; we found this case, too

Note: Earlier version of TCAS spec

Previous slide

Next slide

Back to first slide

View graphic version